{"id":11954,"date":"2022-07-29T10:55:52","date_gmt":"2022-07-29T09:55:52","guid":{"rendered":"https:\/\/42crdev.prexihost.com\/?page_id=11954"},"modified":"2023-02-15T10:51:16","modified_gmt":"2023-02-15T10:51:16","slug":"financial-services","status":"publish","type":"page","link":"https:\/\/staging2022.42crunch.com\/financial-services\/","title":{"rendered":"Financial Services"},"content":{"rendered":"\n
APIs have enabled the digital transformation witnessed in the banking and financial services’ sectors over the past decade. Innovation has been driven by connecting developers and financial institutions using APIs to integrate banks with third-party cutting-edge mobile banking, insurance and wealth management applications. \u00a0Much of these advances have\u00a0 been facilitated by a proactive regulatory environment that seeks to balance data protection with data sharing. For example the Payments Services Directive (PSD2) is compelling banks to create best practices in APIs, vendor integration and data management. But stakeholder companies also need to comply with strict data protection regulations such as GDPR.<\/p>\n
Unfortunately this explosion in the adoption of APIs has been mirrored by a dramatic increase in the attack surface. Well documented breaches include those at Equifax, Experian and Paypal. Such attacks cause both financial and reputational damage and can ultimately lead to share price devaluation and a change of leadership. Given the ubiquity of APIs and the critical role they play in unlocking banking and financial data, CISOs must include API security at the top of their priority list.<\/p>\n\t\t\t\t\n
Without adequate API Security controls in place, all of these financial service providers risk running into trouble, not only with the legislators, but also the hackers. At 42Crunch we enable development and security teams to collaborate to enforce continuous API security at every stage of the API lifecycle thus ensuring the protection of customer data and the compliance with industry legislation. Simply identifying a zombie or shadow API is not sufficient when valuable and sensitive personal financial information is at risk, not to mention the financial penalties that legislators can impose.<\/p>\n\t
Colin Domoney<\/p>\n\t
Colin Domoney, API security research specialist and developer advocate with 42Crunch, explains why existing AppSec tools fare badly on APIs.<\/p>\n